From 11ffa5702c1d6cafdbfd6fdb791008fbbe1b9283 Mon Sep 17 00:00:00 2001
From: Nanne Baars <nanne.baars@owasp.org>
Date: Sun, 29 Apr 2018 15:02:19 +0200
Subject: [PATCH] Added "WebWolf" enabled to the lessons which support the
 usage of WebWolf

---
 .../src/main/resources/static/css/main.css       |  13 +++++++++++++
 .../main/resources/html/WebWolfIntroduction.html |   2 ++
 .../src/main/resources/images/wolf-enabled.png   | Bin 0 -> 6828 bytes
 .../lessonPlans/en/IntroductionWebWolf.adoc      |  14 ++++++++++++--
 .../xxe/src/main/resources/html/XXE.html         |   1 +
 .../src/main/resources/images/wolf-enabled.png   | Bin 0 -> 6828 bytes
 6 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 webgoat-lessons/webwolf-introduction/src/main/resources/images/wolf-enabled.png
 create mode 100644 webgoat-lessons/xxe/src/main/resources/images/wolf-enabled.png

diff --git a/webgoat-container/src/main/resources/static/css/main.css b/webgoat-container/src/main/resources/static/css/main.css
index d9347acb8..59f674616 100644
--- a/webgoat-container/src/main/resources/static/css/main.css
+++ b/webgoat-container/src/main/resources/static/css/main.css
@@ -1066,6 +1066,7 @@ span.show-next-page, span.show-prev-page {
 
 /* ATTACK DISPLAY */
 .attack-container {
+  position: relative;
   background-color: #f1f1f1;
   border: 2px solid #a66;
   border-radius: 12px;
@@ -1150,4 +1151,16 @@ div.captured-flag {
     height: 117px;
     width: 1268px;
     margin-bottom: 20px;
+}
+
+#content {
+  position:relative;
+}
+
+.webwolf-enabled {
+  position:absolute;
+  top: 10px;
+  right: 25px;
+  width: 42px;
+  height: 47px;
 }
\ No newline at end of file
diff --git a/webgoat-lessons/webwolf-introduction/src/main/resources/html/WebWolfIntroduction.html b/webgoat-lessons/webwolf-introduction/src/main/resources/html/WebWolfIntroduction.html
index fc443b7c7..70586184c 100644
--- a/webgoat-lessons/webwolf-introduction/src/main/resources/html/WebWolfIntroduction.html
+++ b/webgoat-lessons/webwolf-introduction/src/main/resources/html/WebWolfIntroduction.html
@@ -12,6 +12,7 @@
 <div class="lesson-page-wrapper">
     <div class="adoc-content" th:replace="doc:Receiving_mail.adoc"></div>
     <div class="attack-container">
+        <img th:src="@{/images/wolf-enabled.png}" class="webwolf-enabled"/>
         <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <form class="attack-form" accept-charset="UNKNOWN"
               method="POST" name="form"
@@ -66,6 +67,7 @@
 <div class="lesson-page-wrapper">
     <div class="adoc-content" th:replace="doc:Landing_page.adoc"></div>
     <div class="attack-container">
+        <img th:src="@{/images/wolf-enabled.png}" class="webwolf-enabled"/>
         <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <a href="/WebGoat/WebWolf/landing/password-reset" target="_blank">Click here to reset your password</a>
 
diff --git a/webgoat-lessons/webwolf-introduction/src/main/resources/images/wolf-enabled.png b/webgoat-lessons/webwolf-introduction/src/main/resources/images/wolf-enabled.png
new file mode 100644
index 0000000000000000000000000000000000000000..d343c07d9a9cd66a32b4fcccd4b05f16dbcd7cdd
GIT binary patch
literal 6828
zcmV;d8dK$oP)<h;3K|Lk000e1NJLTq007ni008d@1^@s6j+QD*00006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY3ljhU3ljkVnw%H_000McNliru;shKJB`CRfg`)rf8aYWs
zK~#9!?VWp^R#nx<zcUQOfPjdAfTUnxf|_zk4NVaXQ@nzRn2NVl%--_#l4QnFGwma0
zre?jGRz#wtS+81nODz$51<A+@85$}YDvSt-TxQ-s)_wxUne#knpMB2R=RE8C`RtDl
zGtYVUS!e&wzOB6$D2n2onpD0epc636l-+?{fWAN{pb1zHtOM2ptAXXf-+^a=X9;N3
zN2NI8DBvQX8Tb=02bc?N%!jZ7`T^sBqk)k?gXNVr0)H_ExSN2Nv~4JsoCo}{m3IFo
z(9d6C1=IpZ0AB${19b@)=P$r5z$^mRX<Jb$<V(PeHro70F<$%$3QGia0&p3yTS|s{
z8@LX*Nd=~qVJPqv&@tq1+PfSM);JK=fu@0v$jE3*fvKhkYtlBPw4feXVCME=bO%;u
zFRXyB!1sW&fLad>_y=GL0k3IWQnui7;M*1aU4P(T*$OLQ7%&@I-Sdf6z-a{BtL;ev
zh67KVVO}{#n!j~II}1^r0^9@i^3aeSfC-FZ8%FUMkJGGet7_?FMlm~7`1k(@%y;$W
zwGl;i32=w0w6D|x7Xvd0sMq#YmDB(~2L?y@%)}Ny4@FkD6CMf%Tn${3GXvibj3;2d
zwzaC_Qs6rlpSup(FC7a^LAHz9L-a+lnhHgAv013dBfkPp))m95A#A_OhMvH??uUW_
zCjwXJ*w82D_@$sk;~?O6+&Vs3t$5dz5!D{ZN=fIO8@vgaM8MtJ_6kdX#4D$#!)tCp
z7Q~v}2}>Mj=aZf%MbfMSh7<6Lw!y;D4)`;$pX2Mk4(#N*o4dR~q5|j&{KU9lDaGQ9
z1VmL5mc#L5zzE>$1$+Rbfm5{|7K*{Z_Y=DIBG(hMYe~j4-3P8B$o-sA5q1Y21-41(
z`hRmLtbikcQ63xfdBo}Vam&y52L4;yWbQc$IiT1l!S8S=ESTo8G2Z~bK)^M?A!clC
zbGrC^<3z0FbFTbLWUng8XV`3B;tqrrFpBJsf0UyMm`uQOQ`aT}Zbuv~=S93$H{f(_
zqq$>W;5lRyIB8xW#xatXJ=PSDjrs!u9&2Ujx&$~BSx%3_+1gHX#Y8jwPwPa*Q*l0A
zyF~--h6LL1bzXI8$nRGpfoP(z8$lvVw2FHU1!m&-_<R}Wx)GMds%Y@gsO!xTFzopK
zxn@x!DigHLdQTTKr)rn-_rB;#SciFP*l7eTZ1cAP1F`pIJY3tY_k0!Tk-_)A9OuI|
zrg7E+Z{gqJ#ks&i1Z@QQka|B#yzPM<30S7>*GuY<m?nKP`0iMayrmv%7Y{|X7CB}g
z7CGlU;_tcXJj-9kWhAQDl!P_R!@7NgfW;w0z+Hi>9DL7kZNFX*1Ie?n_VTP=j{!dl
z5mg=VQ`{V9*-hK8mkb3C$h)xmc~qxWz!_yu{C?e`(fex~_L8q;{Qd1+2+Jq;o(n=_
z0|pEMu5|c)-L(ySM-SxWcb0T=AuL~_E<H%VZDodlci`uKo8pes2oDFH2HUz2mJf&j
zRsdfv^EVd*`)Io>G_}ZTZ`N$%LRc<Y0vwDuOui6lOdYnL6tFjbd)_N<I1<a_@IDO%
zONSX<Wm$M0IFx|5jTjC_;<W8u=5xO$U{;8z>dg>P18^1}Urw$&>9Jg-!C3?x@*h!&
zAeJNNrk)M?+;Yl$)n8VDIF<afKmHuD-Oh!u;-(_q2uvVoC9q+@3g8R0eP-(HRzJ7-
z^CL($0`CfK&))D&kLuFhg|OoK%B_M>FNsFP$+x8|{x1l)FXVF#NDS^I<8Lg{_Ur}2
z@XHb0Nsskc2kJg6^e;Ax>q+x3ZvbB_bKNU}Aqg9Bv9@V1xRkV#&8H}=1r925qX|bH
zCazURT=yg16^$W(dq7GP+4<V0GiNw(jAwOnBCI8_#iD~9b->RFIKGUy)&fTp@KDI#
zbVhsu(+I&fPuq2-)Bx9mcY##5k1s6o%X`E@W$KW;RO8Bst6b)ftASlpFy2dg7Atd(
z13u?ry`1z|0Ka!sp?cs>0?V#FU^H^nJ`En!cAY5=z;sXR=1f@k6FneHn7HnWEG~)l
z_tO-I1+%qnXUawR;bqYp-Q5UF78ZWzuwpjix}NloalAyJ^Q#Qm3BNOh_HrXE;TFf0
zD~W4d1-;ebq#H!@C)&0%WjcQ6vhGTZQxq*D;Xa8Z?{Y1!I|(>0L{vS1TT?VzBa-<~
z$%fJ7BlKKPH^LGwPoRP&ah=r0?{5V9rf9J1&CplLX2BvaqlF#Z2`k`1XeE?$d`kOV
zUvKe!X96drXsowME}xQ8o@v0qoYb{PoW|Z77Xi=UeuK8w^cIIA@c@UWEGmFY30SS|
zI};8AF33@Rd)t1n^{~B<^A@A%3XDvs!UKUZz@DV*ANB}vA&*B-)~v*)FUcl}OM>Ts
zCtS_3w(PQBD$s*ng&a|7(l(w6R}gd4H3O{o*xDAB`1DPHLJXUlkf^$PL?jyq1Cw)D
z@15NXOT@JZ3GkBlxBPSh?$!34>4HU_3Tta|%|aG4^2#rfoW)8u^Z~}_wC??}4BT0n
zPhP<H%@{dv+(-GSx=ON~Tc)>q4Y(FbspMO%_V!qYAg|onHDDUDRGODY`U_wp0qeDG
zXG&{_UzZs%jQ|E9@gg6>&y1pbCo8PYJ=e*&^MX%mq2jw{u|h?aJtZ&kcYr&AvB+xM
z#cX|g`x+$ZkZ*k2=0kRSNCBTlj$G{OnGqV1w5q?;_UsMaOj#N-+BpM4LW^h1v%qK4
z5tfLnGm@X`Jp4FTeLpaTfH$-)=Zf*bU8J95ILZj97w}#>!rCmbk-&9iml^RjU}|V2
zUBy?%0{7y7gyR#<FgBq%R_nr=i$pM;fJDPhi)F}S%3u{$E*S&dLq5WWAD!M%uyv8u
z0$&8qMwU;L*c6<H96Ojr;3PD*l0Ju;o~lz$>bn{_o3$<*VQnq4UP!FCqk#jlPiwj!
zIehs5aBpZ{VkHk8g)DsKEy2aH5E8XHHDPTnvU*?-B#iK2U>C$Czxx&j-iWN~EjRO~
z7lDPq0^_%+<e%e#8RRo-%naZZeT0f{oMK*{%{eWNXc{TSGfEyi%{ecJ>7!J9pa$`%
zXf8;(P9Ld~HKj!C%>^ot>0?#0qze+hySZTHJ$<xFR_ui2qHZo|sntiUq|H9STLl(X
zGq9~bW+hEd0M-;-RL%IC#6c+-9gs-I%~evi*GH}-O@G99vsy&83BU3rD+Qw~@J--@
zf(z+I;AUWh`T2Ey^hy%!fP_70tdbt8bR20YFbDXyHUY&Y1I(NI!zvo~H3Ktk4OXXZ
zMhRgLB<teDDs3yew5~X1e<W>g5gcdZlxMUlC~;|z>_t6Q<zm{hyrRuQiL)T_E#OTR
z(#MKs{Zt~+8HqgfJK!S~P-y9(%|$84VMrLSH7b~j%g)+tl(skocv?kbRrawlxGuLB
zmwMnhB!kC(Y7T4qs<0Fg@9WcmbBK|gTKNyXR9Mx^wx)MF1vmgbjOUU*Dy-^a5O4$%
zdH6t}K~0hfJE*XV%|IidQNY1KKQ&1z^j2XNPe=!uqC(Q4pkg^k+5=g=+aLHWy71r&
zx_FTTwnNVLd<uzSUn)DQX}rbiD83#uPM%@Nv5P~HMA7ZkB)KE9PPE5LZhkZg@yFXu
z&5?T=AX+Xq6_z_XnV#v(W{#v3hmI<&^w|qI3-}Ux;<TuA0amK8l4oZm=kkfjVuVus
z(TL8m5~7b0(?m1W(}kbvp;m?Emfpa4B*mxt;8iaxqJBW%x*w;P5z_?3g-DmjtD99w
zuIx?PV@0RO7GfHuVp6tXR#Z``nBYv{AvT8))}p0Uo;Gu7tCwuG4Fv}QN13v}_Do6$
zV}OTkKV0;oU@fpOa5QivFhtvnQXz}ue7K0h>Ii(^i0KF{52`6u&n6WX^fW!vk){jp
zr0qh9NjKn)Y7|y`WEJl;<RGBVmlT(DueKhm9yk@4iewa2l%#sBsu0$Wh&$2w=rMIA
zdHNPjSlby9eFBM*Hw0PP`wZ$*q@>57ybG%qIK~X`4np$VDoWPunpa`fB0(lEM^D)*
z1?#c0@Vux&mc_3GKCRDB@sth7w#`P{UL#G$An7N6tD;gor#&%NozoIlFC;J19Aptf
zQSyLwY{xX_SO){Mv5e2AC>dfM!zAe*>kQLNsi+j+nGf6!tli?@R{L1dbATrFT#uG~
zlu4%D_62?gyc4I#N@`Vb5-<bx-&69#FyJ{?7fWI&xG(TC6_t`R-g9{|*TUK!xEpbl
zRg|j5rLbzu@NXwItD?ek$A1BbsY#Wbvc~1bTrFM<0{)5|i&vC9(hYduryi>vaEFRY
zQQQjaYe*<DMNu3L1qT3&(BLgf{^?G{R6R-dSU0Jtl!DO3m!aTz;Bb8&isDXKU4R?Z
zd`f|6@IhEtAOT+#r6_dBT3ADX^Yl3=id$iQ56!Ek6pwAQ6xKmVq5(xI8XL0|)>O5>
zQb1-SL5`deWrKJKvKg#-i<KhrHzaeTQzzUgJ=VD@Dy3ko1je}*Rg@m99$1D3g^9|C
zzyrVv^K(}u_wf$Mc13qJQD$rc#v;LvoKxxQ-WOF=R*VDw5c2zNfZdT;i=Ri%vvp9j
zrNTFo5>*s#MWgscEiYTxxjS$T5`s%@m|VHl2W8g)Z|cK{TxQ0w`A)zuRA7meM@b<j
zOC@uxPXRCK$RRSbf#YLdql+0L4h8lA`k1*{FC8*k@rqdieAfqIor;_gR-&=kyp)on
zyAj$zWGiGCaG(*L@^RJz!+q)`eyqa>>+*>VhV6R;SDCl7K7-BWdf$}(XMHHv<)RFq
zTP@;#_NYDwnvtxbUa>+SigkGvKk_Dz2If`yvl!%)sJf{*Vi#YWmTQsNkE^TnIqa0S
zvBS`baC}blq#jMc4}m>_KUU#$_{b+=^;BKN<_P@qT6q;X1egMRP-Uxv-Uw?4)kSRT
zfnz<ZQ?ps^9ct!Y)gY=5d=gd<)rAvAcv`Q20-r--m~1St{olx9LK}v9U%O$b$93BX
zOhZnGFDa<~U-wN|iW_#t|Fdj!fxUp~1?;`vP+=95Ziug+@2o~PwRbafu;p9)ZYgjd
za5Zo;;&WHZ-swBu^~9H>`%tdRw4A;aIuq^<-U<Jm2*&%?V`<7$cT6Uqp$%38>qCCO
z7I@6_dw9V&VST82aK->&R6+0Ud5`P10r-b+!dkC-aLSZ|-q))h*X`vj7Guf@YprU*
zDdS1@j8;}OdR(_fS$t_ZVQo+?IJfsD1-!4-9@lNYkHT7`T5!%u$a1y{D;*a4D6Dm=
z1LxEsQG#k!SgG)w_E^=!0l?V>x*u2V<SE2q`87w^`xo$@kHT858c2-E1-chkDR3@C
zygT+sA}{B%x2i-~o3#BW#xOO(R{WjKM_862r=8=nK!sI(v`1pOE5grO{QMi>?U>hG
z=&P{O7z(~$#R68(7NHrK)#BfpfG1;KcfPN}N`u8fyDDr<|E4(mgmLFsPt*F*j-@f}
zyUbT%bxENPPgL=oLJ?*sFcn#t<qc&WrRg;!qh2-gRDtfLQ_NxDuiN-tzdQ~DD-l-G
zNAqt6cCJ!kJyf83i8Hd9N82ZS;~Wn4y2nZ~n9OS6HnMf^S&JM=Pn(ryUQrY}Col|b
zK$7y=vcP9yB{>wFiFifto#Fl8j%-FwB3&<&hbh)dsBMqc4BQjaTh&=!_kA)xj$ck#
zNd}tyUnC99;EeA5ZQwiR|7QVTAieWv_Y`bcYr7vekG5C-;zYK3&WP4qVf9Yvdp|^u
za}Ot*<LYaHiO7;{iKl_nQ+OcjfCmdEtiFzifta=tM_BkQtfUqe9x&n>n87`N1e`$Y
zn~yV*06IzXM~dfz+28RnkeE}11-=_Bsmv53&Gm04-Do{4DIa&D9g^ujsXAOm@%WpC
z9sU$@y*lFMUmobQv3e%du(r%}@lcAQT1w^1w>^<1;3VpCV!=dJ3#_uR!;~_^KwJC1
z?YqJDNuW_}Y|+IpNl8@CAxW{Lu)kT%a9x)@3nr{REo`u!@U5J$#IWzZzPxSPB8fy@
zKW6jBT|Ma}1A7n&{QqXe&pic9bzGPAc$8e)5uda8%)^9duHP?4eZ1cvywLHRdN~qm
zxx}YZ=&5cYo`Y`<@QB0uETDMYX<>(x%Um-~V)Bu`8|+5Mjr{Z$*B_U#sBXZ`QvLuW
zw~~uGO)r?JY7h_dC^lF__=a-t820@L@!0U1-#TpMb6Yg>j=<dsifT4)_s1@BRIdXI
zCae(_HkeiBn#ablZ!R307dUE6AF|oIq66?%Gv7%{RL|r7xJzdT3mN|)pRwD+xYEK7
zN0qtewJ~gbT^@|~uA_#2p=nT)kR|UVhkvgV@2Ei-aqE6*0q0jy_peq`KG8;;7y7Zj
z8*CegL%<Pcr6%cxipGSOvKwR8Z$!aF^+^jG+*anA+au1&wl?nVyU_+aYV3cCX{acZ
z*3k*tqu#-AxM)fKF0imexn~q-LF=D+Fxr9SC!yO$^FWehHwW{pqVY^b8@yS;%jKpR
zHlE>=aoW1kZaI0ln~*(`q<7nQiTU}4f{AJ%;+YeLSxDriFb<AUr@46$R_C0E>MUe~
z63>Ozo8-eBq{&2!&&)3K`@X=C7<GCg55jui@_K7XCsy`)#F_Q>6esF&s6&pb6op9<
z|9+VnI)-t0jQYF-yqE{W*?JeBO)`$FTb9+pp()$rKHRu;6`|L%ak{;^g6sZ<cn$$x
z(N>SOi0J7huQ5h%pJ07gB1h=wq--Y_%eXyF1L#m?y;bSO6h=p2OpH1`nI{7-jPS<z
zIpVpVWKXq>?2cT#;_yBm!CiKaw5dZ<<3!zGEcdb<OBEf(xvIjOnuF|DB`K;G94sKj
z;TgyG^LO%@)$tgTIUn_-7`A+uob3@-a;#&P88#*<s^5F?hQB1Cx#Fog6PC>pnsXB#
z5&R~PUH?yM+mqld+#fAzS+2*Agb5uZ4vnLfsX1v2!;yWcsP{Lh%ys+6wBOhAD6B4K
zVpzI~CeyW-hB1pt&PC}=&up=sS$s(1e)G^c{%CPuuT^l}Gh^EB_`I$H)gaji$FOyr
zf(FYsSh?~JexF;K46MMtTh=I#@41)dv%a;0YyTvs?WR#Mh9n@WMHw$rR7!8tbGy9v
zH%T_~a2!5wc~6zhA>-QduA&L+2*(ZUe$vUu<&yJoyCHs?r}ufH<^5E$^7#bu54IMH
zvm7?4Ysqg`$B{^=Y8Q5BB3^_dpM=#&Wy|2db}%2W^UYv!*8g32Bdh{WL1IeeHT%X~
zBd*1c=CiJX;JBpG;xh{<@68VJy=dx*@5|{GH^qF@%tIm|6@~3_7bnEGl`fmp!j+zn
zY9M~#)?<n!tT<ix4D#<Y*BaXae{mqJS12DFB28*6hP&5Cxc<IoNLQG6B5{U-wn^!3
zFvGu(3Mj0SlW^R;%AW+z@#wxv9xzD_AD<!KvU#DxcH3+Y-$L<1fVD<HBw|$D{k*Oo
z-P6Gl>wja!>$eA9#@_d`FuWh}=I4;#l|S3JXxzw7KBfGri8vRs@!|WjrJXhuWopq7
z@y1^#KXEi%GMadKp4JdOOG=VN3D7y;;`$wt6X-U!+Per1W&qLlX2wvx9EG?n6=BnO
zWQ2OJ2Rd1N$1Rq2I;9AWB}(qBStysq5Y`4@cTeu4KH^KlChF2;OFR9jC~x6P-&%uI
zSJWVRy5jgy`VucA%A(9=mUGjpb!|GGDs_;IL3iXBMV!zCml7|VybGcnN_^OIUTW(O
zwh;IMaAaQR^iwOm+0m+}tvD#=e5+LMCYw{$?SXX>>bZ_^$LbnnKXiA*srx4E@)@^v
z6z6H+8|34}1R%TWmF&aRs+K;+)wnxileSBk&2so{=7n-LFw@lgJ>spFMlG8VPobf{
zH;!Lba5HzRhT2>Jc-~Qi`8Se;JZU}&e3y7`M?RD$-~l{Nr&>u+k@HkTZL*)EAz`z5
z^Cy)QVkqLu)Rc2UwUzyGGO~B(4V5Gu+gJ4y$_=<Z+W%eLC12PE$(OvLfP!l6+}Lzr
zXCE5Ha?0<$G^ln$=}h$Cmz6Y<C(MiQT{Bd?6WA+4y~YBsR)L^edpXTSGO1)jCD|Sq
zsBS9a@RS<O2H-n{A4S=fWD~CErL0BrWT);dUdaaDt*V)dnVn*zS%?INDK(n@W}fjt
zl??l$ln0P_`>Anc1(iCd3Ix%BoiAKV24&Ew-zUE3eKnM2SSAd&*=MR`v+dae3aJmW
zk8>BW)C?Kc5I^tLKQidyyOQ6;3~4{}dyykgk&@!sM7JroDY=Q_96alSq^+5R1QBiR
zMbu5(U*Q=8{1x~g<fQYvNqos;WxCH*1u*1Z$nk{_Di|(|jqyFh&D&6iUHK_1feUcF
z|J9kwe8sxtP)q}X^UW|eilL(%>DU>V09=RLoLgGbFaN?}DD)#M{L(xGs^0}T2}$Gm
zVhjVf_2%jc9EbP@&Y}F?pO*ZUb%^tDY${C<=3CC99nCWH`M^EETMms|T9R!Cd=|I@
z34yjr8(vkERkRW%D(WWKVk$ehxDj#OT$++_wnvU1^gtr?4n*RH4>tcza%j37$v!fG
zV#Z2T%CiKCx$%LGu=*peE|oGJ2_0=qFSCd+(3I|o*GD&G|ERO+Eqan{LUBc@ggcM}
zz>)cq#p+4ay^?w)D99Y#d4Frsl2$p~Mp!?v_@ZxCc<nmGwdPfQI9hUC{)vV2`NI}p
z^d8~ST-%wR@I`$nS_)FW6;)U-SbotDTe((y;53rUVXQ?<R%J!hDbO;@FWQ8-1eF#f
zF47^NmV%e5QC0=#BT2q(S!R~PHNcEgbY7^9D6Ba2RZ%Hb!jLH0KjxVps~^>sHAGRO
a()j;X%($zc4fA;b0000<MNUMnLSTY4U=FAN

literal 0
HcmV?d00001

diff --git a/webgoat-lessons/webwolf-introduction/src/main/resources/lessonPlans/en/IntroductionWebWolf.adoc b/webgoat-lessons/webwolf-introduction/src/main/resources/lessonPlans/en/IntroductionWebWolf.adoc
index 34940c37a..7bfdf1524 100644
--- a/webgoat-lessons/webwolf-introduction/src/main/resources/lessonPlans/en/IntroductionWebWolf.adoc
+++ b/webgoat-lessons/webwolf-introduction/src/main/resources/lessonPlans/en/IntroductionWebWolf.adoc
@@ -1,7 +1,17 @@
 == Introducing WebWolf
 
-NOTE: You only need WebWolf if you a lesson specifies you can use it. For a lot of lessons you use WebGoat without
-starting WebWolf. If you need to do an exercise with WebWolf make sure it is running along side with WebGoat.
+You only need WebWolf if you a lesson specifies you can use it. For a lot of lessons you use WebGoat without
+starting WebWolf. If you need to do an exercise with WebWolf make sure it is running along side with WebGoat. Lessons
+where you can use WebWolf are marked with the following icon (top right in assignment):
+
+{nbsp}
+
+image::images/wolf-enabled.png[width=115,height=128]
+
+{nbsp}
+
+Even if the icon the present your are not obliged to use WebWolf, you can also use any intercepting tool you like, like
+`netcat` etc.
 
 WebWolf is a separate web application which simulates an attackers machine. It makes it possible for us to
 make a clear distinction between what takes place on the attacked website and the actions you need to do as
diff --git a/webgoat-lessons/xxe/src/main/resources/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/html/XXE.html
index 39eadc226..f0706e8e3 100644
--- a/webgoat-lessons/xxe/src/main/resources/html/XXE.html
+++ b/webgoat-lessons/xxe/src/main/resources/html/XXE.html
@@ -144,6 +144,7 @@
 <div class="lesson-page-wrapper">
     <div class="adoc-content" th:replace="doc:XXE_blind_assignment.adoc"></div>
     <div class="attack-container">
+        <img th:src="@{/images/wolf-enabled.png}" class="webwolf-enabled"/>
         <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <form class="attack-form" accept-charset="UNKNOWN"
               method="POST" name="form"
diff --git a/webgoat-lessons/xxe/src/main/resources/images/wolf-enabled.png b/webgoat-lessons/xxe/src/main/resources/images/wolf-enabled.png
new file mode 100644
index 0000000000000000000000000000000000000000..d343c07d9a9cd66a32b4fcccd4b05f16dbcd7cdd
GIT binary patch
literal 6828
zcmV;d8dK$oP)<h;3K|Lk000e1NJLTq007ni008d@1^@s6j+QD*00006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY3ljhU3ljkVnw%H_000McNliru;shKJB`CRfg`)rf8aYWs
zK~#9!?VWp^R#nx<zcUQOfPjdAfTUnxf|_zk4NVaXQ@nzRn2NVl%--_#l4QnFGwma0
zre?jGRz#wtS+81nODz$51<A+@85$}YDvSt-TxQ-s)_wxUne#knpMB2R=RE8C`RtDl
zGtYVUS!e&wzOB6$D2n2onpD0epc636l-+?{fWAN{pb1zHtOM2ptAXXf-+^a=X9;N3
zN2NI8DBvQX8Tb=02bc?N%!jZ7`T^sBqk)k?gXNVr0)H_ExSN2Nv~4JsoCo}{m3IFo
z(9d6C1=IpZ0AB${19b@)=P$r5z$^mRX<Jb$<V(PeHro70F<$%$3QGia0&p3yTS|s{
z8@LX*Nd=~qVJPqv&@tq1+PfSM);JK=fu@0v$jE3*fvKhkYtlBPw4feXVCME=bO%;u
zFRXyB!1sW&fLad>_y=GL0k3IWQnui7;M*1aU4P(T*$OLQ7%&@I-Sdf6z-a{BtL;ev
zh67KVVO}{#n!j~II}1^r0^9@i^3aeSfC-FZ8%FUMkJGGet7_?FMlm~7`1k(@%y;$W
zwGl;i32=w0w6D|x7Xvd0sMq#YmDB(~2L?y@%)}Ny4@FkD6CMf%Tn${3GXvibj3;2d
zwzaC_Qs6rlpSup(FC7a^LAHz9L-a+lnhHgAv013dBfkPp))m95A#A_OhMvH??uUW_
zCjwXJ*w82D_@$sk;~?O6+&Vs3t$5dz5!D{ZN=fIO8@vgaM8MtJ_6kdX#4D$#!)tCp
z7Q~v}2}>Mj=aZf%MbfMSh7<6Lw!y;D4)`;$pX2Mk4(#N*o4dR~q5|j&{KU9lDaGQ9
z1VmL5mc#L5zzE>$1$+Rbfm5{|7K*{Z_Y=DIBG(hMYe~j4-3P8B$o-sA5q1Y21-41(
z`hRmLtbikcQ63xfdBo}Vam&y52L4;yWbQc$IiT1l!S8S=ESTo8G2Z~bK)^M?A!clC
zbGrC^<3z0FbFTbLWUng8XV`3B;tqrrFpBJsf0UyMm`uQOQ`aT}Zbuv~=S93$H{f(_
zqq$>W;5lRyIB8xW#xatXJ=PSDjrs!u9&2Ujx&$~BSx%3_+1gHX#Y8jwPwPa*Q*l0A
zyF~--h6LL1bzXI8$nRGpfoP(z8$lvVw2FHU1!m&-_<R}Wx)GMds%Y@gsO!xTFzopK
zxn@x!DigHLdQTTKr)rn-_rB;#SciFP*l7eTZ1cAP1F`pIJY3tY_k0!Tk-_)A9OuI|
zrg7E+Z{gqJ#ks&i1Z@QQka|B#yzPM<30S7>*GuY<m?nKP`0iMayrmv%7Y{|X7CB}g
z7CGlU;_tcXJj-9kWhAQDl!P_R!@7NgfW;w0z+Hi>9DL7kZNFX*1Ie?n_VTP=j{!dl
z5mg=VQ`{V9*-hK8mkb3C$h)xmc~qxWz!_yu{C?e`(fex~_L8q;{Qd1+2+Jq;o(n=_
z0|pEMu5|c)-L(ySM-SxWcb0T=AuL~_E<H%VZDodlci`uKo8pes2oDFH2HUz2mJf&j
zRsdfv^EVd*`)Io>G_}ZTZ`N$%LRc<Y0vwDuOui6lOdYnL6tFjbd)_N<I1<a_@IDO%
zONSX<Wm$M0IFx|5jTjC_;<W8u=5xO$U{;8z>dg>P18^1}Urw$&>9Jg-!C3?x@*h!&
zAeJNNrk)M?+;Yl$)n8VDIF<afKmHuD-Oh!u;-(_q2uvVoC9q+@3g8R0eP-(HRzJ7-
z^CL($0`CfK&))D&kLuFhg|OoK%B_M>FNsFP$+x8|{x1l)FXVF#NDS^I<8Lg{_Ur}2
z@XHb0Nsskc2kJg6^e;Ax>q+x3ZvbB_bKNU}Aqg9Bv9@V1xRkV#&8H}=1r925qX|bH
zCazURT=yg16^$W(dq7GP+4<V0GiNw(jAwOnBCI8_#iD~9b->RFIKGUy)&fTp@KDI#
zbVhsu(+I&fPuq2-)Bx9mcY##5k1s6o%X`E@W$KW;RO8Bst6b)ftASlpFy2dg7Atd(
z13u?ry`1z|0Ka!sp?cs>0?V#FU^H^nJ`En!cAY5=z;sXR=1f@k6FneHn7HnWEG~)l
z_tO-I1+%qnXUawR;bqYp-Q5UF78ZWzuwpjix}NloalAyJ^Q#Qm3BNOh_HrXE;TFf0
zD~W4d1-;ebq#H!@C)&0%WjcQ6vhGTZQxq*D;Xa8Z?{Y1!I|(>0L{vS1TT?VzBa-<~
z$%fJ7BlKKPH^LGwPoRP&ah=r0?{5V9rf9J1&CplLX2BvaqlF#Z2`k`1XeE?$d`kOV
zUvKe!X96drXsowME}xQ8o@v0qoYb{PoW|Z77Xi=UeuK8w^cIIA@c@UWEGmFY30SS|
zI};8AF33@Rd)t1n^{~B<^A@A%3XDvs!UKUZz@DV*ANB}vA&*B-)~v*)FUcl}OM>Ts
zCtS_3w(PQBD$s*ng&a|7(l(w6R}gd4H3O{o*xDAB`1DPHLJXUlkf^$PL?jyq1Cw)D
z@15NXOT@JZ3GkBlxBPSh?$!34>4HU_3Tta|%|aG4^2#rfoW)8u^Z~}_wC??}4BT0n
zPhP<H%@{dv+(-GSx=ON~Tc)>q4Y(FbspMO%_V!qYAg|onHDDUDRGODY`U_wp0qeDG
zXG&{_UzZs%jQ|E9@gg6>&y1pbCo8PYJ=e*&^MX%mq2jw{u|h?aJtZ&kcYr&AvB+xM
z#cX|g`x+$ZkZ*k2=0kRSNCBTlj$G{OnGqV1w5q?;_UsMaOj#N-+BpM4LW^h1v%qK4
z5tfLnGm@X`Jp4FTeLpaTfH$-)=Zf*bU8J95ILZj97w}#>!rCmbk-&9iml^RjU}|V2
zUBy?%0{7y7gyR#<FgBq%R_nr=i$pM;fJDPhi)F}S%3u{$E*S&dLq5WWAD!M%uyv8u
z0$&8qMwU;L*c6<H96Ojr;3PD*l0Ju;o~lz$>bn{_o3$<*VQnq4UP!FCqk#jlPiwj!
zIehs5aBpZ{VkHk8g)DsKEy2aH5E8XHHDPTnvU*?-B#iK2U>C$Czxx&j-iWN~EjRO~
z7lDPq0^_%+<e%e#8RRo-%naZZeT0f{oMK*{%{eWNXc{TSGfEyi%{ecJ>7!J9pa$`%
zXf8;(P9Ld~HKj!C%>^ot>0?#0qze+hySZTHJ$<xFR_ui2qHZo|sntiUq|H9STLl(X
zGq9~bW+hEd0M-;-RL%IC#6c+-9gs-I%~evi*GH}-O@G99vsy&83BU3rD+Qw~@J--@
zf(z+I;AUWh`T2Ey^hy%!fP_70tdbt8bR20YFbDXyHUY&Y1I(NI!zvo~H3Ktk4OXXZ
zMhRgLB<teDDs3yew5~X1e<W>g5gcdZlxMUlC~;|z>_t6Q<zm{hyrRuQiL)T_E#OTR
z(#MKs{Zt~+8HqgfJK!S~P-y9(%|$84VMrLSH7b~j%g)+tl(skocv?kbRrawlxGuLB
zmwMnhB!kC(Y7T4qs<0Fg@9WcmbBK|gTKNyXR9Mx^wx)MF1vmgbjOUU*Dy-^a5O4$%
zdH6t}K~0hfJE*XV%|IidQNY1KKQ&1z^j2XNPe=!uqC(Q4pkg^k+5=g=+aLHWy71r&
zx_FTTwnNVLd<uzSUn)DQX}rbiD83#uPM%@Nv5P~HMA7ZkB)KE9PPE5LZhkZg@yFXu
z&5?T=AX+Xq6_z_XnV#v(W{#v3hmI<&^w|qI3-}Ux;<TuA0amK8l4oZm=kkfjVuVus
z(TL8m5~7b0(?m1W(}kbvp;m?Emfpa4B*mxt;8iaxqJBW%x*w;P5z_?3g-DmjtD99w
zuIx?PV@0RO7GfHuVp6tXR#Z``nBYv{AvT8))}p0Uo;Gu7tCwuG4Fv}QN13v}_Do6$
zV}OTkKV0;oU@fpOa5QivFhtvnQXz}ue7K0h>Ii(^i0KF{52`6u&n6WX^fW!vk){jp
zr0qh9NjKn)Y7|y`WEJl;<RGBVmlT(DueKhm9yk@4iewa2l%#sBsu0$Wh&$2w=rMIA
zdHNPjSlby9eFBM*Hw0PP`wZ$*q@>57ybG%qIK~X`4np$VDoWPunpa`fB0(lEM^D)*
z1?#c0@Vux&mc_3GKCRDB@sth7w#`P{UL#G$An7N6tD;gor#&%NozoIlFC;J19Aptf
zQSyLwY{xX_SO){Mv5e2AC>dfM!zAe*>kQLNsi+j+nGf6!tli?@R{L1dbATrFT#uG~
zlu4%D_62?gyc4I#N@`Vb5-<bx-&69#FyJ{?7fWI&xG(TC6_t`R-g9{|*TUK!xEpbl
zRg|j5rLbzu@NXwItD?ek$A1BbsY#Wbvc~1bTrFM<0{)5|i&vC9(hYduryi>vaEFRY
zQQQjaYe*<DMNu3L1qT3&(BLgf{^?G{R6R-dSU0Jtl!DO3m!aTz;Bb8&isDXKU4R?Z
zd`f|6@IhEtAOT+#r6_dBT3ADX^Yl3=id$iQ56!Ek6pwAQ6xKmVq5(xI8XL0|)>O5>
zQb1-SL5`deWrKJKvKg#-i<KhrHzaeTQzzUgJ=VD@Dy3ko1je}*Rg@m99$1D3g^9|C
zzyrVv^K(}u_wf$Mc13qJQD$rc#v;LvoKxxQ-WOF=R*VDw5c2zNfZdT;i=Ri%vvp9j
zrNTFo5>*s#MWgscEiYTxxjS$T5`s%@m|VHl2W8g)Z|cK{TxQ0w`A)zuRA7meM@b<j
zOC@uxPXRCK$RRSbf#YLdql+0L4h8lA`k1*{FC8*k@rqdieAfqIor;_gR-&=kyp)on
zyAj$zWGiGCaG(*L@^RJz!+q)`eyqa>>+*>VhV6R;SDCl7K7-BWdf$}(XMHHv<)RFq
zTP@;#_NYDwnvtxbUa>+SigkGvKk_Dz2If`yvl!%)sJf{*Vi#YWmTQsNkE^TnIqa0S
zvBS`baC}blq#jMc4}m>_KUU#$_{b+=^;BKN<_P@qT6q;X1egMRP-Uxv-Uw?4)kSRT
zfnz<ZQ?ps^9ct!Y)gY=5d=gd<)rAvAcv`Q20-r--m~1St{olx9LK}v9U%O$b$93BX
zOhZnGFDa<~U-wN|iW_#t|Fdj!fxUp~1?;`vP+=95Ziug+@2o~PwRbafu;p9)ZYgjd
za5Zo;;&WHZ-swBu^~9H>`%tdRw4A;aIuq^<-U<Jm2*&%?V`<7$cT6Uqp$%38>qCCO
z7I@6_dw9V&VST82aK->&R6+0Ud5`P10r-b+!dkC-aLSZ|-q))h*X`vj7Guf@YprU*
zDdS1@j8;}OdR(_fS$t_ZVQo+?IJfsD1-!4-9@lNYkHT7`T5!%u$a1y{D;*a4D6Dm=
z1LxEsQG#k!SgG)w_E^=!0l?V>x*u2V<SE2q`87w^`xo$@kHT858c2-E1-chkDR3@C
zygT+sA}{B%x2i-~o3#BW#xOO(R{WjKM_862r=8=nK!sI(v`1pOE5grO{QMi>?U>hG
z=&P{O7z(~$#R68(7NHrK)#BfpfG1;KcfPN}N`u8fyDDr<|E4(mgmLFsPt*F*j-@f}
zyUbT%bxENPPgL=oLJ?*sFcn#t<qc&WrRg;!qh2-gRDtfLQ_NxDuiN-tzdQ~DD-l-G
zNAqt6cCJ!kJyf83i8Hd9N82ZS;~Wn4y2nZ~n9OS6HnMf^S&JM=Pn(ryUQrY}Col|b
zK$7y=vcP9yB{>wFiFifto#Fl8j%-FwB3&<&hbh)dsBMqc4BQjaTh&=!_kA)xj$ck#
zNd}tyUnC99;EeA5ZQwiR|7QVTAieWv_Y`bcYr7vekG5C-;zYK3&WP4qVf9Yvdp|^u
za}Ot*<LYaHiO7;{iKl_nQ+OcjfCmdEtiFzifta=tM_BkQtfUqe9x&n>n87`N1e`$Y
zn~yV*06IzXM~dfz+28RnkeE}11-=_Bsmv53&Gm04-Do{4DIa&D9g^ujsXAOm@%WpC
z9sU$@y*lFMUmobQv3e%du(r%}@lcAQT1w^1w>^<1;3VpCV!=dJ3#_uR!;~_^KwJC1
z?YqJDNuW_}Y|+IpNl8@CAxW{Lu)kT%a9x)@3nr{REo`u!@U5J$#IWzZzPxSPB8fy@
zKW6jBT|Ma}1A7n&{QqXe&pic9bzGPAc$8e)5uda8%)^9duHP?4eZ1cvywLHRdN~qm
zxx}YZ=&5cYo`Y`<@QB0uETDMYX<>(x%Um-~V)Bu`8|+5Mjr{Z$*B_U#sBXZ`QvLuW
zw~~uGO)r?JY7h_dC^lF__=a-t820@L@!0U1-#TpMb6Yg>j=<dsifT4)_s1@BRIdXI
zCae(_HkeiBn#ablZ!R307dUE6AF|oIq66?%Gv7%{RL|r7xJzdT3mN|)pRwD+xYEK7
zN0qtewJ~gbT^@|~uA_#2p=nT)kR|UVhkvgV@2Ei-aqE6*0q0jy_peq`KG8;;7y7Zj
z8*CegL%<Pcr6%cxipGSOvKwR8Z$!aF^+^jG+*anA+au1&wl?nVyU_+aYV3cCX{acZ
z*3k*tqu#-AxM)fKF0imexn~q-LF=D+Fxr9SC!yO$^FWehHwW{pqVY^b8@yS;%jKpR
zHlE>=aoW1kZaI0ln~*(`q<7nQiTU}4f{AJ%;+YeLSxDriFb<AUr@46$R_C0E>MUe~
z63>Ozo8-eBq{&2!&&)3K`@X=C7<GCg55jui@_K7XCsy`)#F_Q>6esF&s6&pb6op9<
z|9+VnI)-t0jQYF-yqE{W*?JeBO)`$FTb9+pp()$rKHRu;6`|L%ak{;^g6sZ<cn$$x
z(N>SOi0J7huQ5h%pJ07gB1h=wq--Y_%eXyF1L#m?y;bSO6h=p2OpH1`nI{7-jPS<z
zIpVpVWKXq>?2cT#;_yBm!CiKaw5dZ<<3!zGEcdb<OBEf(xvIjOnuF|DB`K;G94sKj
z;TgyG^LO%@)$tgTIUn_-7`A+uob3@-a;#&P88#*<s^5F?hQB1Cx#Fog6PC>pnsXB#
z5&R~PUH?yM+mqld+#fAzS+2*Agb5uZ4vnLfsX1v2!;yWcsP{Lh%ys+6wBOhAD6B4K
zVpzI~CeyW-hB1pt&PC}=&up=sS$s(1e)G^c{%CPuuT^l}Gh^EB_`I$H)gaji$FOyr
zf(FYsSh?~JexF;K46MMtTh=I#@41)dv%a;0YyTvs?WR#Mh9n@WMHw$rR7!8tbGy9v
zH%T_~a2!5wc~6zhA>-QduA&L+2*(ZUe$vUu<&yJoyCHs?r}ufH<^5E$^7#bu54IMH
zvm7?4Ysqg`$B{^=Y8Q5BB3^_dpM=#&Wy|2db}%2W^UYv!*8g32Bdh{WL1IeeHT%X~
zBd*1c=CiJX;JBpG;xh{<@68VJy=dx*@5|{GH^qF@%tIm|6@~3_7bnEGl`fmp!j+zn
zY9M~#)?<n!tT<ix4D#<Y*BaXae{mqJS12DFB28*6hP&5Cxc<IoNLQG6B5{U-wn^!3
zFvGu(3Mj0SlW^R;%AW+z@#wxv9xzD_AD<!KvU#DxcH3+Y-$L<1fVD<HBw|$D{k*Oo
z-P6Gl>wja!>$eA9#@_d`FuWh}=I4;#l|S3JXxzw7KBfGri8vRs@!|WjrJXhuWopq7
z@y1^#KXEi%GMadKp4JdOOG=VN3D7y;;`$wt6X-U!+Per1W&qLlX2wvx9EG?n6=BnO
zWQ2OJ2Rd1N$1Rq2I;9AWB}(qBStysq5Y`4@cTeu4KH^KlChF2;OFR9jC~x6P-&%uI
zSJWVRy5jgy`VucA%A(9=mUGjpb!|GGDs_;IL3iXBMV!zCml7|VybGcnN_^OIUTW(O
zwh;IMaAaQR^iwOm+0m+}tvD#=e5+LMCYw{$?SXX>>bZ_^$LbnnKXiA*srx4E@)@^v
z6z6H+8|34}1R%TWmF&aRs+K;+)wnxileSBk&2so{=7n-LFw@lgJ>spFMlG8VPobf{
zH;!Lba5HzRhT2>Jc-~Qi`8Se;JZU}&e3y7`M?RD$-~l{Nr&>u+k@HkTZL*)EAz`z5
z^Cy)QVkqLu)Rc2UwUzyGGO~B(4V5Gu+gJ4y$_=<Z+W%eLC12PE$(OvLfP!l6+}Lzr
zXCE5Ha?0<$G^ln$=}h$Cmz6Y<C(MiQT{Bd?6WA+4y~YBsR)L^edpXTSGO1)jCD|Sq
zsBS9a@RS<O2H-n{A4S=fWD~CErL0BrWT);dUdaaDt*V)dnVn*zS%?INDK(n@W}fjt
zl??l$ln0P_`>Anc1(iCd3Ix%BoiAKV24&Ew-zUE3eKnM2SSAd&*=MR`v+dae3aJmW
zk8>BW)C?Kc5I^tLKQidyyOQ6;3~4{}dyykgk&@!sM7JroDY=Q_96alSq^+5R1QBiR
zMbu5(U*Q=8{1x~g<fQYvNqos;WxCH*1u*1Z$nk{_Di|(|jqyFh&D&6iUHK_1feUcF
z|J9kwe8sxtP)q}X^UW|eilL(%>DU>V09=RLoLgGbFaN?}DD)#M{L(xGs^0}T2}$Gm
zVhjVf_2%jc9EbP@&Y}F?pO*ZUb%^tDY${C<=3CC99nCWH`M^EETMms|T9R!Cd=|I@
z34yjr8(vkERkRW%D(WWKVk$ehxDj#OT$++_wnvU1^gtr?4n*RH4>tcza%j37$v!fG
zV#Z2T%CiKCx$%LGu=*peE|oGJ2_0=qFSCd+(3I|o*GD&G|ERO+Eqan{LUBc@ggcM}
zz>)cq#p+4ay^?w)D99Y#d4Frsl2$p~Mp!?v_@ZxCc<nmGwdPfQI9hUC{)vV2`NI}p
z^d8~ST-%wR@I`$nS_)FW6;)U-SbotDTe((y;53rUVXQ?<R%J!hDbO;@FWQ8-1eF#f
zF47^NmV%e5QC0=#BT2q(S!R~PHNcEgbY7^9D6Ba2RZ%Hb!jLH0KjxVps~^>sHAGRO
a()j;X%($zc4fA;b0000<MNUMnLSTY4U=FAN

literal 0
HcmV?d00001